[TouchPad General] nlra:
Read-only flash / unable to delete 'store'

Hey all, new here. Apologies ahead of time for the length, but I hope it will end up being worth it for some of you. I actually don't have a problem myself, but was doing some research about the various ways TouchPads have been (and thus could still possibly be) bricked, and what known-working fixes existed for those scenarios. I intend to start playing around with other OSes on my TouchPad and want to make sure I don't do anything stupid; if I know what can brick a TP, then perhaps I can make sure to avoid doing those things.

From what I can tell, between jcsullins' TPDebrick (for Qualcomm Downloader Mode problem) and this thread (complete NAND wipe and repartition), it seems almost impossible to permanently brick a TouchPad, which is impressive.

"Almost," though, being the key word. There are a troubling number of people in this thread and elsewhere (both here on XDA and other forums) whose TouchPad NANDs have become stuck in some sort of permanent read-only mode, where no writes to flash that they do actually stick. It's system-wide, too, not just in one OS. This is what is preventing people from completing the steps listed in the OP of this thread: they can't wipe the logical volumes on the flash because they can't write to the flash. And as far as I have been able to tell, nobody has found a fix yet, so the only way people who have had their TouchPads afflicted by this malady have gotten past this is if HP replaces their TouchPad for them. That's kinda scary. What's even more scary is that it seems like every story about a TouchPad stuck in read-only mode corresponds to an attempt at an Android install; I've not found anybody who only uses WebOS who has also suffered from this, which suggests that somehow some component of the Android port might be causing this.

One thread that I ran into, though, got my wheels turning, because it included a link to the datasheet for the SanDisk flash chip that is in the TouchPad (unfortunately, I cannot include the URL and properly give attribution to the author because this forum won't let me as a n00b include outside links; if you want it, PM me). It's called an iNAND (that's the trademark name), and it is an eMMC chip, which means it is not just a flash chip, but a flash chip with a built-in flash controller that essentially presents itself to the OS the way an SD card controller/slot would: the OS thinks it's talking to an SD/MMC card!

There seems to be a misconception both in the post I linked to as well as by people who have composed other posts that the flash chip in the TouchPad has failed in some way when this happens, and that either the chip simply broke in such a way that you can no longer write to it, or it has gone into a perpetual read-only mode as a fallback/"safe-mode" measure in response to some other failure or corruption. But if you read the datasheet, it's pretty clear at least that the chip is not designed to fall back to a read-only mode in response to corruption or breakage elsewhere. In section 2.9 (p. 11), "Enhanced Write Protection", it explains that the entire flash chip can be purposefully write-protected by changing some flags in the CSD ("Card Specific Data") register.

The CSD register is further laid out in detail on section 4.3.4 (p. 21), where it is revealed to be a 128-bit-wide register consisting mostly (as I found out by reading another document -- page 86 of the "SD Specifications, Part 1, Physical Layer Simplified Specification, Version 2.00", which again I am not allowed to link to...thank XDA) of read-only values and a couple of changeable values. Two of the changeable ones are bits 12 (TMP_WRITE_PROTECT) and 13 (PERM_WRITE_PROTECT). If either of these bits are set to '1', the entire flash chip is write-protected. But there is an important difference between the two bits: the former can be set and unset at-will (and the setting survives loss of power). The latter, once set, can NEVER be undone and will write-protect the chip permanently!

I suspect that those of you with TouchPads that will no longer accept writes made to the NAND have had one (or both) of those bits in the CSD of the SanDisk eMMC toggled to be 'on' (1) somehow. How, I know not. Perhaps there is a bug in the 2.6.35 kernel SD/MMC driver, or perhaps there is a bug in ClockworkMod for the TouchPad, or perhaps there is a bizarre bug in moboot itself. Or maybe there *is* an engineering defect in these iNAND chips that causes these bits to flip themselves under certain rare (or perhaps not-so-rare) conditions. I dunno. But if we are lucky, then only TMP_WRITE_PROTECT is getting set, which is something that theoretically CAN be undone.

There is a way to read the CSD from the command shell via sysfs, so if you can boot up your device and get to a shell somehow, we can try to check this. If this theory turns out to be correct, then we can perhaps try to work on a way to unset TMP_WRITE_PROTECT (or at least confirm that PERM_WRITE_PROTECT was set and so know with certainty that nothing more can be done). Execute this command:

cat /sys/class/mmc_host/mmc0/mmc0:0001/csd

You should see a 32-digit-long (16-byte/128-bit) hexadecimal number when you do this; this is the contents of the CSD register. My TouchPad's eMMC's CSD register, for example, looks like this (16GB TouchPad):

d00f00320f5903ffffffffff92404010

The part we are interested in is the 4th digit from the right; as you can see in my case, the last 4 digits are 4010, and the 4 is the digit of import. 4 is in fact what we want to see here. If TMP_WRITE_PROTECT is set, this will be a 5 instead of a 4. If PERM_WRITE_PROTECT is set, it will be a 6. If both TMP_WRITE_PROTECT and PERM_WRITE_PROTECT are set, it will be a 7. Given what the MMC CSD spec states, it is unlikely for that number to be anything other than something between 4 and 7 (bit 14, the Copy bit, is almost always set to 1 from the factory and is unchangeable once set to 1, and bit 15 will always be 0).

So those of you with still-bricked read-only TouchPads, if you could run this test and report back with the contents of your CSD, I suspect the results would be very educational!

-- Nathan